Privacy Notice

Last updated: 8 October 2026

Controller

The controller of your personal data is yBook. Contact for any data protection request: contact@ybook.fr. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, for users in the European Union, the EU GDPR.

What we collect

• Account: email address, username, password (stored only as an irreversible hash), date of birth (to check you are 18 or over — never displayed), language.
• Profile and portfolio: the information you choose to publish, photos, videos, approximate location (town only).
• Messaging: the content of messages exchanged with other members.
• Payments: order reference, amount and status. Card details are handled exclusively by SumUp and never stored by us.
• Security and technical data: IP address, connection and abuse logs, moderation records.

Why we use it and our lawful bases

• Providing the service and your account — performance of a contract.
• Keeping members safe, moderating content, preventing fraud and abuse — legitimate interests and legal obligation (including the Online Safety Act 2023).
• Processing payments and keeping accounting records — contract and legal obligation.
• News and offers by email — consent, which you can withdraw at any time from your Account page.

Private messages and moderation

Private messages are not end-to-end encrypted. Authorised moderators may access conversations for safety, to handle reports, to enforce our Terms or to meet legal obligations. Every access is recorded in a tamper-proof audit log.

Photos

Photo metadata (EXIF, including any GPS location) is removed when you upload an image. Originals of private-album media are stored outside the public web space and only served after an access check.

Who we share data with

Only with service providers acting on our behalf: our web host Infomaniak Network SA (data stored in Switzerland, which benefits from a UK adequacy decision), SumUp for payments, and our email provider. We may disclose data to the authorities where required by law. We never sell your data.

How long we keep it

Account data is kept while your account is active and deleted when you delete it, except where we must keep certain records (accounting, legal requests, moderation and security logs, kept for a limited period).

Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, and to data portability. You can edit your information, export all your data and delete your account directly from your Account page, or write to us. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) or, in the EU, to your national supervisory authority (in France, the CNIL).

Cookies

See our Cookie Notice.